triage-alert

Alert Triage Skill

Perform standardized initial assessment of security alerts to determine if they represent real threats requiring investigation or can be closed as false positives.

Inputs

You need one of these identifiers to begin:

• ALERT_ID - The alert identifier
• CASE_ID - The case identifier

Workflow

Step 1: Gather Initial Context

Retrieve full details about the alert/case:

Use secops-soar tools:
- get_case_full_details(case_id) - Get case metadata and context
- list_alerts_by_case(case_id) - List all alerts in the case
- list_events_by_alert(alert_id) - Get triggering events

Extract and note:

• Alert type and severity
• Key entities involved (IPs, domains, hashes, users, hostnames)
• Triggering events and timestamps

Note: Duplicate detection should be handled by invoking /check-duplicates before this skill, or by using the /full-triage-alert workflow which orchestrates both skills in the correct sequence.

Step 2: Find Related Open Cases

Search for other open cases involving the same entities:

Use secops-soar.list_cases with:
- Search terms = key entities from Step 1
- Status filter = "Opened"

Note any related cases for correlation.

Step 3: Alert-Specific SIEM Search

Perform a targeted SIEM search based on the alert type:

Use secops-mcp.search_security_events with relevant query

By alert type:

• Suspicious Login: Search login events (success/failure) for user/source IP around alert time
• Malware Detection: Search process execution, file mods, network events for the hash/endpoint
• Network Alert: Search network flows, DNS lookups for source/destination IPs/domains

Step 4: Enrich Key Entities

For each key entity (IP, domain, hash, URL), gather threat intelligence:

GTI Enrichment (use gti-mcp tools):

• get_ip_address_report(ip) - IP reputation and context
• get_domain_report(domain) - Domain reputation
• get_file_report(hash) - File/hash analysis
• get_url_report(url) - URL reputation